A Practical Application of SIM/SEM/SIEM Automating Threat Identification

The goal of this paper is to explain how to use a SIEM effectively to identify and respond to security threats. The paper begins with level set information including definitions, capabilities requirements, architecture and a business case. Later I will cover aggregation and correlation design...

By

David Swift

May 21, 2007

All papers are copyrighted. No re-posting of papers is permitted

Related Content

Why SANS - Blog - Zero Trust - Zero Trust Network Architecture- Ready for Prime Time__340 x 340.jpg

November 15, 2024

Zero Trust Network Architecture: Ready for Prime Time?

This infographic outlines the principles of implementing a Zero Trust architecture by focusing on strategies like micro-segmentation and continuous authentication.For a deeper dive into these topics, download the SANS Zero Trust Strategy Guide and watch the YouTube video to gain actionable...

Why SANS - Blog - Critical Infrastructure - Supply Chain Attacks- Why Security Leaders Must Act Now_340 x 340.jpg

November 15, 2024

Fortifying the Supply Chain: Strategies for Modern Security Challenges

This infographic emphasizes securing the supply chain against modern threats by distinguishing supply-chain risks from internal risks and recommending best practices for managing external dependencies.For a deeper dive into these topics, download the ICS Strategy Guide and watch the YouTube video...

Cybersecurity Insights, Digital Forensics, Incident Response & Threat Hunting, Cyber Defense, Cloud Security, Open-Source Intelligence (OSINT), Cybersecurity Leadership, Security Awareness, Artificial Intelligence (AI)

December 18, 2023

Top 15 SANS Summit Talks of 2023

This year, SANS hosted 16 Summits with 209 talks. Here were the top-rated talks of the year.